Re: libclamav versus clamd

Andreas wrote:

> Now, this user in the samba mailing list said that, after recompiling and using
> samba-vscan-clamav with libclamav support, performance dropped terribly. I assume
> this is because now every smbd process is scanning the files, each on of the
> processes with its own copy of the virus database perhaps in memory.

Do you have a reference to this posting you've mentioned? And, yes, 
loading libclamav in each smbd process has it's drawbacks.


> So, would it be fair to conclude:
> - use libclamav support if you prefer to have the scan to take place with the
> privileges of the connecting user and have lots of RAM and cpu cycles to burn
> - use clamd if you don't mind in having to change file system permissions
> (perhaps via posix acls) so that the clamav user has broader privileges and can
> read everything, and also if you require better performance

To be honest, this sums up the current situation very well. The problem 
is that the unix domain socket is owned by a specific user (i.e. 
"clamav"), but the smbd process are running with various user ids.

Possible solutions:
- change the permissions of the unix domain socket, so that everyone can 
read/write from it. Probleme here: everyone can send arbitrary commands 
to clamav
- don't use a unix domain socket but TCP socket instead. Is the net 
support of clamd stable now? I think there was a patch for vscan-clamav 
to support TCP sockets as well (but I currently do not recall if the 
patch was sent to me via email, posted to a ML or submitted via SF.net
tracker *sigh*). Of course, everyone can send arbitrary commands via TCP 
sockets as well
- changed the effective UID to a specific user when connecting to
unix domain socket and reading/writing from/to it. This was implemented
for vscan-fsav and I was thinking to use this concept for vscan-clamav 
as well. But my full-time job keeps me too busy (and, well, to be 
honest, on those weekends I'm together with my girl friend I try to 
spend as much time as possible with her). Therefore, the development 
process is currently very slow - unfortunately.

Suggestions, feedback and contributions are welcome :-)

best regards
Rainer Link




-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g. 
Take an Oracle 10g class now, and we'll give you the exam FREE.
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click